January 2013 - anti-abuse-wg - mailman.ripe.net

Notice: Fradulent RIPE ASNs
by Ronald F. Guilmette 02 Feb '13

02 Feb '13

After a careful investigation, I am of the opinion that each of the following 18 ASNs was registered (via RIPE) with fradulent information purporting to represent the identity of the true registrant, and that in fact, all 18 of these ASNs were registered by a single party, apparently as part of a larger scheme to provide IP space to various snowshoe spammers. Evidence I have in hand strongly links this scheme and these ASNs and their associated IPv4 route announcements to Jump Network Services, aka JUMP.RO. Furthermore, all of these ASNs are apparently peering with exactly and only the same two other ASNs in all cases, i.e. GTS Telecom SRL (AS5606) and Net Vision Telecom SRL (AS39737). These peers and the fradulent ASNs listed below are all apparently originated out of Romania. AS16011 (fiberwelders.ro) AS28822 (creativitaterpm.ro) AS48118 (telecomhosting.ro) AS49210 (rom-access.ro) AS50659 (grandnethost.com) AS57131 (speedconnecting.ro) AS57133 (nordhost.ro) AS57135 (fastcable.ro) AS57176 (bucovinanetwork.ro) AS57184 (kaboomhost.ro) AS57415 (highwayinternet.ro) AS57695 (effidata.ro) AS57724 (id-trafic.ro) AS57738 (mclick.ro) AS57786 (hosting-www.ro) AS57837 (romtechinnovation.ro) AS57906 (momy.ro) AS57917 (nature-design.ro) At present, the above 18 ASNs are currently announcing routes for a total amount of IP space equal to 1,022 /24s, which is the rough equivalent of an entire /14 block. These IPv4 route announcements are listed below, sorted by IPv4 (32-bit) start address. Additional potentially relevant background information: http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets… http://www.spamhaus.org/rokso/evidence/ROK9107/world-company-register-eu-bu… http://www.spamhaus.org/sbl/listings/jump.ro Current route announcements: 31.14.30.0/24 31.14.32.0/24 31.14.33.0/24 31.14.34.0/23 31.14.36.0/22 31.14.40.0/22 31.14.44.0/24 31.14.45.0/24 31.14.46.0/23 31.14.48.0/24 31.14.49.0/24 31.14.50.0/23 31.14.52.0/22 31.14.56.0/21 31.14.64.0/24 31.14.65.0/24 31.14.66.0/23 31.14.68.0/22 31.14.72.0/21 31.14.80.0/20 31.14.112.0/20 31.14.144.0/20 37.153.128.0/22 37.153.132.0/22 37.153.140.0/22 37.153.144.0/21 37.153.152.0/22 37.153.160.0/21 37.153.168.0/22 37.153.172.0/23 37.153.174.0/23 37.153.176.0/20 37.156.0.0/22 37.156.4.0/22 37.156.8.0/21 37.156.16.0/23 37.156.18.0/23 37.156.20.0/23 37.156.22.0/23 37.156.24.0/23 37.156.26.0/23 37.156.28.0/23 37.156.30.0/23 37.156.36.0/24 37.156.37.0/24 37.156.38.0/23 37.156.48.0/21 37.156.56.0/22 37.156.100.0/22 37.156.104.0/22 37.156.108.0/22 37.156.112.0/20 37.156.128.0/20 37.156.144.0/22 37.156.148.0/22 37.156.152.0/21 37.156.160.0/21 37.156.168.0/22 37.156.172.0/23 37.156.180.0/23 37.156.184.0/22 37.156.188.0/22 37.156.208.0/22 37.156.216.0/22 37.156.224.0/24 37.156.225.0/24 37.156.226.0/23 37.156.228.0/23 37.156.230.0/23 37.156.232.0/23 37.156.234.0/23 37.156.236.0/23 37.156.238.0/23 37.156.240.0/21 37.156.248.0/22 37.156.252.0/22 46.102.128.0/20 46.102.144.0/20 46.102.160.0/21 77.81.120.0/23 77.81.126.0/24 77.81.160.0/22 84.247.4.0/22 84.247.18.0/23 84.247.40.0/22 85.204.18.0/24 85.204.20.0/23 85.204.30.0/23 85.204.36.0/22 85.204.54.0/23 85.204.64.0/23 85.204.66.0/24 85.204.76.0/23 85.204.96.0/23 85.204.104.0/23 85.204.120.0/24 85.204.121.0/24 85.204.124.0/24 85.204.132.0/23 85.204.152.0/23 85.204.176.0/21 85.204.194.0/23 86.104.0.0/23 86.104.2.0/24 86.104.4.0/24 86.104.9.0/24 86.104.10.0/24 86.104.96.0/21 86.104.115.0/24 86.104.116.0/24 86.104.118.0/23 86.104.121.0/24 86.104.122.0/23 86.104.132.0/23 86.104.192.0/24 86.104.195.0/24 86.104.212.0/23 86.104.215.0/24 86.104.240.0/22 86.104.245.0/24 86.104.248.0/23 86.105.178.0/24 86.105.195.0/24 86.105.196.0/24 86.105.200.0/22 86.105.225.0/24 86.105.227.0/24 86.105.230.0/24 86.105.242.0/23 86.105.248.0/22 86.106.0.0/21 86.106.8.0/23 86.106.10.0/24 86.106.11.0/24 86.106.12.0/24 86.106.24.0/24 86.106.25.0/24 86.106.90.0/24 86.106.95.0/24 86.106.169.0/24 86.107.8.0/21 86.107.28.0/23 86.107.74.0/23 86.107.104.0/24 86.107.195.0/24 86.107.216.0/21 86.107.242.0/23 89.32.122.0/23 89.32.176.0/23 89.32.192.0/23 89.32.196.0/23 89.32.204.0/24 89.33.46.0/23 89.33.108.0/23 89.33.117.0/24 89.33.168.0/21 89.33.233.0/24 89.33.246.0/24 89.33.255.0/24 89.34.16.0/22 89.34.94.0/23 89.34.102.0/23 89.34.112.0/21 89.34.128.0/20 89.34.148.0/23 89.34.200.0/23 89.34.216.0/23 89.34.236.0/22 89.35.32.0/24 89.35.56.0/24 89.35.77.0/24 89.35.133.0/24 89.35.156.0/23 89.35.176.0/23 89.35.196.0/24 89.35.240.0/21 89.36.16.0/23 89.36.32.0/23 89.36.34.0/24 89.36.35.0/24 89.36.96.0/21 89.36.104.0/21 89.36.178.0/23 89.36.182.0/23 89.36.184.0/21 89.36.226.0/23 89.36.236.0/22 89.37.48.0/21 89.37.64.0/22 89.37.76.0/22 89.37.102.0/23 89.37.107.0/24 89.37.129.0/24 89.37.133.0/24 89.37.143.0/24 89.37.240.0/21 89.38.26.0/24 89.38.216.0/22 89.38.220.0/22 89.39.76.0/22 89.39.168.0/22 89.39.180.0/23 89.39.216.0/22 89.40.40.0/24 89.40.66.0/24 89.40.133.0/24 89.40.240.0/21 89.40.254.0/23 89.41.16.0/21 89.41.44.0/22 89.42.27.0/24 89.42.33.0/24 89.42.150.0/23 89.42.208.0/23 89.43.182.0/23 89.43.184.0/23 89.43.216.0/21 89.43.224.0/21 89.44.94.0/23 89.44.115.0/24 89.44.120.0/21 89.44.190.0/23 89.45.11.0/24 89.45.14.0/24 89.45.72.0/21 89.45.126.0/23 89.46.8.0/22 89.46.44.0/23 89.46.47.0/24 89.46.60.0/24 89.46.88.0/22 89.46.192.0/21 89.47.34.0/24 89.47.44.0/22 92.114.36.0/24 92.114.38.0/24 92.114.83.0/24 93.113.216.0/22 93.114.24.0/21 93.114.85.0/24 93.114.86.0/23 93.114.128.0/24 93.114.133.0/24 93.115.32.0/23 93.115.62.0/23 93.115.130.0/23 93.115.134.0/23 93.115.138.0/23 93.115.142.0/23 93.115.192.0/21 93.115.253.0/24 93.117.112.0/21 93.117.120.0/21 93.119.112.0/23 93.119.118.0/23 93.119.120.0/23 93.119.124.0/23 94.176.224.0/20 176.126.168.0/23 176.126.170.0/23 176.126.172.0/23 176.126.174.0/23 176.223.64.0/23 176.223.108.0/24 176.223.111.0/24 176.223.116.0/23 176.223.118.0/24 176.223.167.0/24 176.223.172.0/22 176.223.176.0/24 176.223.177.0/24 176.223.178.0/23 176.223.190.0/24 188.212.22.0/24 188.212.48.0/20 188.213.64.0/20 188.213.112.0/22 188.213.116.0/23 188.213.118.0/24 188.213.119.0/24 188.213.120.0/23 188.213.122.0/23 188.213.124.0/22 188.213.144.0/20 188.213.176.0/22 188.213.180.0/22 188.213.184.0/22 188.213.188.0/22 188.215.18.0/23 188.215.20.0/22 188.215.192.0/19 188.241.188.0/23 188.241.192.0/22 217.19.4.0/24

9 36

CleanIT Update
by Brian Nisbet 31 Jan '13

31 Jan '13

Colleagues, (And cross posted to the Cooperation WG as it may be something interesting for them also.) You may be aware of the the CleanIT project http://www.cleanitproject.eu/ This project has presented to the AA-WG at two RIPE meetings and Tobias and I said we would keep the working group up to date. The final document of the project was officially published yesterday in Brussels and handed over to the EU Counter Terrorism Coordinator Gilles de Kerchove. More information, including a download link for the document can be found here: http://www.cleanitproject.eu/final-document-clean-it-published/ It is unclear at present whether there will be any follow-up to the project, but various parties wish to investigate possibilities. If there are any further moves or projects to come out of this, we will let the AA-WG know. Brian

1 0

proberry.de
by Reza Farzan 29 Jan '13

29 Jan '13

Hello All, In recent days, I have received numerous Spamvertised messages from this domain, "proberry.de" which is hosted by (STRATO-RZG-KA). Here is a copy of the latest such messages, without its header: From: Rupert Sterling <westport(a)genion.de> To: rezaf(a)mindspring.com Subject: Sicherheit im Beerenanbau Date: Jan 27, 2013 4:25 AM Die Homepage "ProBerry" ist eine branchenbezogene Informationsseite zu einem Fachthema, fur Beerenobstanbauer in der BRD: http://proberry.de/ Does anyone knows who is behind this domain, "proberry.de" i.e. who owns it, and what this German text says on this message. So far, and despite my repeated complaints to STRATO-RZG-KA's Abuse Department, 'abuse(a)stratoserver.net' and 'hostmaster(a)strato.de' and 'hostmaster(a)strato-rz.de' this domain remain active, and has not been suspended. To be fair, I have copied Andreas Hartnacke, Provisioning/Hostmaster, so that he would be aware of the this matter. I appreciate any assistance that you may offer in this matter. Thank you, Reza Farzan rezaf(a)mindspring.com

6 6

AA-WG Minutes, RIPE 65
by Brian Nisbet 29 Jan '13

29 Jan '13

Colleagues, Here are the minutes of the WG session at RIPE 65. Please let Tobias or I know if you have any comments or corrections. Thanks, Brian ******************************************** Anti-Abuse Working Group Minutes – RIPE 65 Thursday, 27 September 2012, 14:00-15:30 WG co-Chairs: Brian Nisbet, Tobias Knecht Scribe: Alex le Heux Brian welcomed the audience and introduced himself and Tobias Knecht, Anti-Abuse Working Group co-Chairs. A. Administrative Matters • Welcome • Scribe, Jabber, stenography • Microphone etiquette • Approve minutes from RIPE 64 No comments on RIPE 64 minutes, declared final. Finalise agenda: https://ripe65.ripe.net/presentations/108-AA-WG_RIPE_65.pdf No changes proposed to the agenda. B. Update B1. Recent List Discussion These are all covered by the agenda. B2. CleanIT Project Update - But Klaasen The presentation is available at: https://ripe65.ripe.net/presentations/230Clean_IT_presentatie_27_09_2012.pdf Anto Veldre, Estonian Information System Authority, said it was unclear how is it possible that some club will decide on fundamental rights that must be defined by law. He said he didn’t understand prohibiting the usage of some languages, Arabic or Estonian, or how But succeeded in involving people in making such proposals But Klassen replied that he didn’t understand the question. Brian Nisbet, Anti-Abuse WG co-Chair, replied that he discussed this previously with Anto and will try to help him understand the question. He said they have some examples from brainstorming discussions and that some of them were about enforcing language use on the Internet. Some of the suggestions were on the outer edge of what this community would consider technically feasible. Brian said the question is: how did the people making such suggestions get involved and are these the bulk of the people involved. But Klaassen replied that they don't keep track of who comes up with ideas. This could come from the public or a small discussion group. These are ideas that are under consideration, they came to them and they want to have discussion about them. If it's not legally feasible, it will not get to the end stage. Daniel Karrenberg, RIPE NCC, commented that the problem he has is that on one hand, it's "just ideas", and on the other hand "you are EU". Daniel commented that what he’s hearing from the audience is “first they tried child porn, now they’re trying terrorists”. He added that there was a discussion with someone from Denmark who was explaining how he ran a grassroots thing to help people get around the filtering that has been implemented there. During the discussion someone asked if he wasn't doing something illegal. He was not, the filtering was sort of voluntarily done by the ISPs. He added that in this room, you sometimes have people from the technical community who have successfully resisted things like this in their own countries. He added that it was good But came to engage with them but taking the “it’s all informal” stance doesn’t build confidence. But Klaassen replied that it wasn’t all informal. The issue is that they want to have an open dialog. He said the project proposal states that it’s a process for having a dialogue between different stakeholders in a multi-stakeholder environment and it happens rarely. He said that they’re trying to do this with a balanced group and have an open and constructive dialogue and doesn’t see why that’s a problem. He said he understood there was a lot of misunderstanding around the blue and yellow flag, the document that says they will filter, and this will confuse people so that’s why they didn’t publish it. Arjan Kamphuis, Bits of Freedom, thanked But for coming. He commented that if he would have followed the process and all the steps would have been communicated, that would have been great. He said that many of them had seen stuff like this before, like with ACTA and patents, and that when people first get a hold of documents and get worried, they get answers like “we’re still discussing this” and then suddenly something happens and it gets locked in. This worries many people. He asked But to be proactive about communicating the dates. Arjan then commented about the text. He said he contacted some former intelligence people and got two different responses. The first was that there is no definition of “terrorism”, it could be anything. The second person said that if you took the opening piece of text and replace “Al Qaeda” with “Pentagon”, the sentence still works because the Pentagon killed a hundred times more people over the last ten years. He asked what was the problem that But was trying to solve. But replied that Arjan’s comments are not too late and not too early. He said they ask participants to comment every time they publish it. They get many comments, many useful, and they have a lot of work. It’s been like that from the beginning. He added they were not like ACTA and they have their own process. But said that terrorism websites are not weapons but support terrorists’ daily operations. They are looking for propaganda and radicalisation, that’s what they face in counter-terrorism. They use the EU’s definition in the document. They are trying to take an open approach and make the definition as clear as possible. Jim Reid said they must be careful doing things in this area with the processes in place. Everyone agrees that something needs to be done but wondered how the processes are used on a daily basis. He said there was a concern about mission creep and that noble things like counter-terrorism laws can be deliberately used for other things when the scope and boundary conditions are not clearly laid out. But replied that it was about trust and whether you could trust the government. Jim replied that it’s party about trust, but wondered where the audits and controls were. But said he wanted to change the public image of trust in the government but he can’t. He said that they needed to gain more trust to do the project as openly as they can and publish every two months. Alexander Isavnin, ZAO NetLine, wondered how many terrorism acts have been prevented in the Netherlands. He said he was from a country that But didn’t think was open and free and he was glad to see that slide because it shows an example of counter-terrorism in Russia. He said some students were jailed for preparing a terrorist act against Putin and they were caught on a forum on the Internet. They did make an explosive device. Interestingly, the person pushing them to do it and showing them how was never found. No one believes it. He added that the tradition in Russia is for law enforcement to provoke. He added that people shouldn’t trust the counter-terrorism organisations in Europe that are trying to overrule the Internet. Arjan, XS4ALL, via chat, asked if But could list some of the participants that have been “reached out too” in the creation of the document. But replied that all partners and participants are listed on the website. Brian added that he linked to that page last week. The participants don’t state that they agree with the document. But agreed and said that the process of commitments starts after the last conference. B3. RIPE NCC Data Protection Legal Advice Update – Athina Fragkouli, RIPE NCC The presentation is available at: https://ripe65.ripe.net/presentations/274-Data_Protection_Report.pdf Athina Fragkouli Shane Kerr, ISC, commented on slide 20. He agreed it was a hard problem but wasn’t sure that MNT-BY inputs the data, but he wasn’t sure that person determines the processing. Athina replied that MNT-BY is not the "responsible party", the RIPE NCC is that by default. Denis Walker, RIPE NCC, said by definition the ABUSE-C would not be personal data, that's why they provide bulk access to it. B4. “Requesting feedback about abuse-finder widget in RIPEstat” - Christian Teuschel, RIPE NCC The presentation is available at: https://ripe65.ripe.net/presentations/272-antiabuse_info_ripe65.pdf Christian asked if it would be useful for the RIPEstat team to put more effort into the abuse contact. Three people raised their hands about abuse contact, no one raise their hand about more false positives, about five people raised their hand about more restricted, no one raised their hand about more checks like geolocation and two people raised their hand about distance in RIPE Database objects. Wilfried Woeber, UniVie, commented that the distance only gives an indication about the cluefulness about the people who put in the entries. Leo Vegoda, ICANN, said he looked through the anti-abuse stuff and popped in his private address and it said: "private address, no contact information". He said he looked at what they had in whois.iana.org, and would like to offer to work with you to offer the quality of info to the average user. Christian thanked Leo and said that the abuse widget is very new and they haven’t had much time to improve it yet. Peter Koch, DeNIC, asked for the policy for selecting blacklists. He said you register facts in the RIPE Database and here they extend it to a reputation system. He said the scrutiny is questionable and that the target audience is not qualified to judge this. He added that a line had been crossed and it made him nervous. Daniel Karrenberg replied that this was not their database: it’s RIPEstat. RIPEstat aims to get any data about a resource and present it. He said he shared Peter's concern about presenting it totally unqualified and they’re working on that. Their policy is “anything they can get”. He added that the problem is that most blacklists don't permit re-publication and showing of history. These may not be the greatest ones, but to the knowledgeable person, the current state and history is useful thing to know. He said clearly it’s not part of the registry, but part of the information services that the RIPE NCC provides. They want to put this into context for consumers that aren’t usually geeks. Christian asked the audience to send further feedback by email. Wout de Natris, a consultant, commented that what they’re seeing here is Internet governance how it should be. He advised to gather information from as many independent places as they can. He added that there are a lot of botnet centres and ISPs cooperating with that. There is a lot of data to be gathered of what is going wrong there and they’re making it visible, which is a start. B5. “Re-allocation of address blocks” – Ingrid Wijte, RIPE NCC The presentation is available at: https://ripe65.ripe.net/presentations/264-Reallocation_of_address_blocks.pdf There were no questions. B6. Operation of “Copy Shops” - Peter Forsman, .SE The presentation is available at: https://ripe65.ripe.net/presentations/73-counterfeitwebsites.pdf Daniel Karrenberg asked what the RIPE community could do to help? Peter said he couldn’t say exactly. He was just there to raise awareness because the Swedish law enforcement asked him to help find the websites that target Swedes. He said it couldn’t be done, there are new ones next week. Daniel asked why he thought that the new gTLDs made a difference. It makes no difference what the domain is, they went for the cheapest ones. Peter replied that they go through .cn ones mostly. If ICANN has a problem with registrant data today, there won't be less of a problem with the new TLDs. Daniel replied that the ones listed on his slide were GoDaddy and ENUM, not Chinese. Peter said those were examples. If they see 1,000 new TLDs in the future, the price would be lower than .com today. Daniel added that they would go for the cheapest ones and the ones that are not really good at publishing registrant data. C. Policies RIPE Policy 2011-06 Brian Nisbet announced that 2011-06 has reached consensus. He thanked the task force and Tobias who wrote the bulk of it and push it through. He said they’d speak to the RIPE NCC about implementation. Daniel commented that he loved it and asked how he proposed not having it remain wishful thinking. He added that you can mandate all sorts of things but getting people to populate it is the hard part. Brian said they’d work with the RIPE NCC on the basic information and looking at 2007-01, those are big jobs. He added that they’ve already talked about what’s next in terms of policies such as data verification. He acknowledged that people would continue to do bad things but hoped this would be a first step in creating a framework to improve that. Daniel commented that he’s detecting antagonism about the RIPE NCC doing stuff without asking the community. He added that if they had to make people do something, the community should be directly involved. The community guidance should be very clear. Brian agreed and said that he and Tobias have undertaken that work. He said he did not want the RIPE NCC to get blamed for what’s clearly a community request. D. Interactions Brian Nisbet said there haven’t been many since RIPE 64 but 2011-06 might bring up some so they’ll see what happens. D1. Working Groups D3. RIPE NCC Gov/LEA Interactions Update Brian commented that it’s been a quiet summer and that there’s a certain amount of management by exception done by the LEAs. He said that he’s spoken with Jochem de Ruig, RIPE NCC, and was informed about planned interactions with the LEAs. X. A.O.B. There were no AOBs. Z. Agenda for RIPE 66 Brian Nisbet asked the audience to email input for the RIPE 66 Anti-Abuse Working Group agenda to the mailing list, to Brian and Tobias. Brian thanked the audience and closed the session.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 17, Issue 18
by Karl-Josef Ziegler 28 Jan '13

28 Jan '13

> Does anyone knows who is behind this domain, "proberry.de" i.e. who owns it, > and what this German text says on this message. It's a Joe Job against this domain and the owner has informed the police. Best regards, - Karl-Josef Ziegler

1 0

proberry.de
by Reza Farzan 28 Jan '13

28 Jan '13

Hello All, In recent days, I have received numerous Spamvertised messages from this domain, "proberry.de" which is hosted by (STRATO-RZG-KA). Here is a copy of the latest such messages, without its header: ----- From: Rupert Sterling <westport(a)genion.de> To: rezaf(a)mindspring.com Subject: Sicherheit im Beerenanbau Date: Jan 27, 2013 4:25 AM Die Homepage "ProBerry" ist eine branchenbezogene Informationsseite zu einem Fachthema, fur Beerenobstanbauer in der BRD: proberry.de -------- Does anyone knows who is behind this domain, "proberry.de" i.e. who owns it, and what this German text says on this message. So far, and despite my repeated complaints to STRATO-RZG-KA's Abuse Department, 'abuse(a)stratoserver.net' and 'hostmaster(a)strato.de' and 'hostmaster(a)strato-rz.de' this domain remain active, and has not been suspended. To be fair, I have copied Andreas Hartnacke, Provisioning/Hostmaster, so that he would be aware of the this matter. I appreciate any assistance that you may offer in this matter. Thank you, Reza Farzan rezaf(a)mindspring.com

1 0

Please unblock 80.71.128.0/20
by Thilo Bangert 24 Jan '13

24 Jan '13

Hi, we were, a little more than 2 years ago, allocated above subnet and have since struggeled with it, since apparently its previous owner had not treated it well. While it appears that many of the GeoIP issues have been fixed -- its surprising how many sites are out there which NEVER update their maxmind or other databases -- we still have reachability issues, especially into Israeli networks. It has been communicated to us that the past owner had notoriously attacked Israeli websites, which is why the netblok 80.71.128.0/20 had been null routed. One of the websites our customers complain about not being able to view is http://www.english.machonmeir.net/ were we cant get to the DNS server which lives at 62.219.11.42. Trying to reach someone from the other network has thus far not been fruitful. Any help in establishing communication is greatly appreciated. If you null route, could you pleae check whether you are blocking our subnet, and if so kindly reevaluate that decision. Thank you for your help. kind regards Thilo

3 4

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 17, Issue 11
by Karl-Josef Ziegler 21 Jan '13

21 Jan '13

> Thinking about it, just in the last day or two I've realized that > RIPE, ARIN, IANA, ICANN, and all such authorities are in many ways > quite analogous to our Federal Reserve here in the United States. In > both cases, the entities have much authority and are widely perceived > as having charters that somehow commit them to pursuit of the public > good. But in both cases, the reality is rather different... these > entities are in fact merely commercial associations of business > interests that are pledged, if not by law then by contract, to never > reveal even a smidgeon of their commercial member's dirty laundry to > any "outsider", and their iron-clad commitment to this goal always > takes precedence over any other consideration. I agree. The main goal of these organisations for me seems to be not protecting public goods but protecting the commercial interests of their members. So they aren't nonprofit organizations? Best regards, - Karl-Josef Ziegler

3 2

(no subject)
by Dr Michiel de Weger 15 Jan '13

15 Jan '13

2 1

(Long) rant about some LIRs in RIPE region, most likely linked to RFG's earlier email
by Vasile Capdefier 15 Jan '13

15 Jan '13

Disclaimer: this is just my POV, I didn't investigate (too) much/deep. All the information bellow is public, easy to find and Google Translate seems to work most of the times. From what I know, Jump.RO's business model is to *sell* IP space from their ALLOCATED PA ranges received from RIPE. Not *sub-allocate*, not *assign* or similar terms. They don't ask too many questions. They give you IPs faster than other LIRs. They market this as being professional. All of the Jump.RO's sub-allocations (that I've seen in whois) have *ASSIGNED PA* status, which according to ripe-553 [1] is to be used when the range is assigned to an end user for services provided by the issuing LIR. This is probably not the case because except the (new) annual fee for the registration service there are no other services provided by that LIR to the end user. Most of Jump.RO's "end users" are in fact small ISPs that can't afford the RIPE membership fees and bypass the rules of not using PI space for customers by deaggregating Jump's IP space. I don't know about the 12k number, but they have a large client base in the country and neighboring countries. I also think that Jump is aware of their IPs being in use by spammers as they advertise on their website that new and unused IP blocks cost about 2 times more than "used" ones. They also note that the previously "used" PA space is checked with "MxToolBox" in 120 anti-spam lists [2]. Even though Jump.RO's business model isn't exactly in the spirit of the RIPE region rules or following best practices (no prefix aggregation, but their excuse is that they are not the only ones doing it), I don't think that they are willing to risk their LIR status by defending known spam operations, so reporting well documented cases of false information provided during registration first to RIPE and then to them would probably get them to withdraw the PA from that customer. The ranges found by you clearly suggest that fake information has been used. Only "under construction" sites, nobody ever heard of those companies, all using same ISPs. With all this said about ro.registry (Jump.RO's LIR id) i'd like to add the following. There are entire LIRs with very large IP allocations and suspicious activities. I'll just list here a few: (RIPE allocation list publicly available here [3]) The first candidate that pops up is ro.visnet (VisNetwork Media SRL). According to their web page [4] they are a pretty large ISP with over 300 experienced employees and over 30 vehicles used for interventions and installations. They provide no CIF (Romanian for Fiscal Identification Code) or other identifying information, but the company is valid and has CIF 25083281. According to the Romanian Trade Register [5], the company named VisNetwork Media SRL with Fiscal Identification Code 25083281 is registered since February 2009, has no employees (where did those 300 professionals go?) and has registered for the 2011 fiscal year expenses of roughly about 3000 EUR (this value is around the value of the RIPE maintenance fees) and an amazing income of 100 EUR. Also, they are not registerd with ANCOM [6] (Romanian National Agency for Management and Regulation in Communications), so they are not a real ISP. They have received from RIPE the following IP space: 20090624 188.170.0.0/16 ALLOCATED PA 20100713 46.49.128.0/17 ALLOCATED PA 20110404 31.173.0.0/16 ALLOCATED PA 20110707 146.0.128.0/17 ALLOCATED PA 20110707 146.0.32.0/19 ALLOCATED PA 20111012 128.234.0.0/16 ALLOCATED PA 20120113 37.56.0.0/16 ALLOCATED PA 20120405 37.224.0.0/16 ALLOCATED PA 20120730 5.163.0.0/16 ALLOCATED PA 20121113 185.9.244.0/22 ALLOCATED PA 20110331 2a03:4100::/29 With this much IP space I would think they must have at least a few LARGE cities covered, but nobody ever heard of them or their professional employees. Also, because apparently their IPs were not enough and their employees seem that they couldn't handle hosting their main website, their website is hosted on IP ranges from another LIR. visnet.ro has address 77.36.59.10 inetnum: 77.36.59.0 - 77.36.59.255 netname: ROSITE-EQUIPMENTS The second obvious candidate for our small investigation is, as you might have guessed, ro.rosite (RoSite Equipment SRL). Information about their deaggregation habits can be found here [7]. According to the Trade Register, ROSITE EQUIPMENT SRL has CIF 17352052 and is a registered company since march 2005. They are registered as an ISP at ANCOM, but with a different company name (ROSITE NET SRL). Their second company, the one registered as an ISP, ROSITE NET SRL has CIF 13669105 and is a registered company since january 2001. The larger company, not the ISP, received from RIPE a large number of IP addresses: 20090706 188.119.128.0/18 ALLOCATED PA 20090813 188.74.128.0/18 ALLOCATED PA 20091223 188.74.192.0/18 ALLOCATED PA 20100325 62.216.64.0/19 ALLOCATED PA 20100628 178.157.64.0/18 ALLOCATED PA 20110712 146.158.128.0/17 ALLOCATED PA 20110712 146.66.208.0/20 ALLOCATED PA 20120105 37.35.128.0/17 ALLOCATED PA 20120105 37.35.32.0/19 ALLOCATED PA 20120724 5.157.128.0/17 ALLOCATED PA 20101217 2a03:8800::/32 On the third place in our list we have ro.swift (now Media Trend Sistem SRL, formerly using the company Swift Marketing SRL). Swift Marketing SRL (nice name, huh?) was deleted from the Trade Registry in may 2011. During 2010 they had 0 employees. The new company, Media Trend Sistem SRL (CIF 26301830) is registered since december 2009 and was known under another name (not publicly available) until changing it's name to the current one in december 2010. They are also not registered as an ISP with ANCOM and had 0 employees in 2011. This didn't seem to stop them from receiving the following IP ranges from RIPE: 20070730 78.95.0.0/16 ALLOCATED PA 20080319 93.168.0.0/15 ALLOCATED PA 20090303 95.218.0.0/15 ALLOCATED PA 20110518 2a00:aa80::/32 Another interesting Romanian LIR is ro.ssnet (SISTEM SOFT NETWORK SRL). The company is registered with the Trade Register with CIF 24496484 since september 2008, had in 2011 only 1 employee and is not a registered ISP with ANCOM. They became LIR just a few months before the final /8 was reached in RIPE region. They only got from RIPE this /15: 20120719 5.154.0.0/15 ALLOCATED PA They also seem to like deaggregating very much [8], now originating 369 prefixes. Now with all this in sight I suppose the ro.registry issue of about an /14 block seems a rather small issue. [1] https://www.ripe.net/ripe/docs/ripe-553 [2] http://www.ip.ro/ip.html [3] ftp://ftp.ripe.net/pub/stats/ripencc/membership/alloclist.txt [4] http://www.visnet.ro/despre/ [5] http://www.mfinante.ro/agenticod.html [6] http://www.ancom.org.ro/furnizoricomunicatii-electronice_133 [7] http://bgp.he.net/AS49687#_prefixes [8] http://bgp.he.net/AS56465#_prefixes

3 2